Red Hat Security Advisory

RHSA-2026:83879

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images cargo-1.99.1-1.1.hum1@aarch64, cargo-1.99.1-1.1.hum1@s390x, cargo-1.99.1-1.1.hum1@x86_64 +47

Fixes 3 records

TI-2026-71167 CVE-2026-109351 · GHSA-hf39-hrp5-hx3v

Denial of service in Gitoxide gix-pack via pack header object count

MEDIUM 64

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00322 Published 2026-10-12 Partial fix · 0.75.0 CWE-770

TI-2026-71166 CVE-2026-109350 · GHSA-86jp-9qq8-2gwc

Denial of service in Gitoxide gix-pack lets malicious remotes crash fetch

MEDIUM 64

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00321 Published 2026-10-12 Partial fix · 0.75.0 CWE-617

TI-2026-71165 CVE-2026-109349 · GHSA-wmw6-cp8f-c6q8

Reachable assertion in gix-pack panics clients on crafted pack header

LOW 37

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.0027 Published 2026-10-12 Partial fix · 0.75.0 CWE-617